From 59ae16a00d18588e98af57d26e442af8ea42b7aa Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 2 Mar 2013 09:18:26 -0800
Subject: [PATCH] unvalidated indexes in _XkbReadGetGeometryReply()
 [CVE-2013-1997 4/15]

If the X server returns color indexes outside the range of the number of
colors it told us to allocate, out of bounds memory access could occur.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Matthieu Herrb <matthieu.herrb@laas.fr>
---
 src/xkb/XKBGeom.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/xkb/XKBGeom.c b/src/xkb/XKBGeom.c
index 4ad21f85..7140a724 100644
--- a/src/xkb/XKBGeom.c
+++ b/src/xkb/XKBGeom.c
@@ -619,6 +619,9 @@ XkbGeometryPtr	geom;
 	    if (status==Success)
 		status= _XkbReadGeomKeyAliases(&buf,geom,rep);
 	    left= _XkbFreeReadBuffer(&buf);
+	    if ((rep->baseColorNdx > geom->num_colors) ||
+		(rep->labelColorNdx > geom->num_colors))
+		status = BadLength;
 	    if ((status!=Success) || left || buf.error) {
 		if (status==Success)
 		    status= BadLength;